Pentest R120: Audit-Log /:id mit nicht-numerischer ID → 400 statt 500

Beim Suchen eines verify-integrity-Endpoints stiess der Pentester
auf einen 500er: GET /api/audit-logs/verify matcht GET /:id (das
echte Verify ist POST /verify), parseInt("verify") = NaN → Prisma
findUnique({ where:{ id: NaN }}) wirft. Gleiche 400-statt-500-
Klasse wie R64.1/R104.1.

Fix: Number.isNaN-Guard in getAuditLogById, getAuditLogsByCustomer
und updateRetentionPolicy → sauberer 400 „Ungültige ID".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/src/controllers/auditLog.controller.ts

@@ -54,6 +54,12 @@ export async function getAuditLogs(req: AuthRequest, res: Response) {
 export async function getAuditLogById(req: AuthRequest, res: Response) {
   try {
     const id = parseInt(req.params.id);
+    // Nicht-numerische :id (z.B. GET /audit-logs/verify statt POST /verify)
+    // landete sonst als NaN in Prisma findUnique → 500. Sauberer 400.
+    // (Pentest R120 – gleiche „400 statt 500"-Klasse wie R64.1/R104.1.)
+    if (Number.isNaN(id)) {
+      return res.status(400).json({ success: false, error: 'Ungültige Audit-Log-ID' });
+    }
     const log = await auditService.getAuditLogById(id);
 
     if (!log) {
@@ -73,6 +79,9 @@ export async function getAuditLogById(req: AuthRequest, res: Response) {
 export async function getAuditLogsByCustomer(req: AuthRequest, res: Response) {
   try {
     const customerId = parseInt(req.params.customerId);
+    if (Number.isNaN(customerId)) {
+      return res.status(400).json({ success: false, error: 'Ungültige Kunden-ID' });
+    }
     const logs = await auditService.getAuditLogsByDataSubject(customerId);
 
     res.json({ success: true, data: logs });
@@ -187,6 +196,9 @@ export async function getRetentionPolicies(req: AuthRequest, res: Response) {
 export async function updateRetentionPolicy(req: AuthRequest, res: Response) {
   try {
     const id = parseInt(req.params.id);
+    if (Number.isNaN(id)) {
+      return res.status(400).json({ success: false, error: 'Ungültige Policy-ID' });
+    }
     const { retentionDays, description, legalBasis, isActive } = req.body;
 
     const policy = await auditService.updateRetentionPolicy(id, {